I have not updated this page for a long time and in the meantime I learned much more about the player. Recently Philips has released a detailed datasheet for the LPC2880 chip, which is very similar to PNX0101. Please look at PhilipsPNX0101 for info.

Emulator

I am writing the player emulator. The current version is available at
http://www.mimuw.edu.pl/~tmal/rockbox/. It emulates the hardware described below,
features a simple ncurses user interface and the possibility to be a GDB target.

Initialization

Many things such as location of different kinds of memory in the
address space is probably not hardwired, but is set by software during
initialization. However, it is impossible to figure out the meaning of
values written to registers during initialization having only one
example of code. Analysis of other PNX0101 based players firmware or
experiments with the real hardware could let us find out some
information, but I do not suppose it is required, since Rockbox can be
run by the original firmware after it initializes the hardware.

Program Flash

PNX0101 has 512 kB of embedded program flash ROM. It is located in the
range 0x800000-0x87ffff. The first part of the firmware is stored
there. The second one is stored in the external flash ROM. The
external flash ROM is probably SST39LF800A? (8 Mbit), although the
firmware can autodetect chips with manufacturer's ID 0xbf and device
ID 0x2780, 0x2781 or 0x2782. Code from that chip is visible in the
range 0xa00000-0xafffff, although for purposes other than program
execution the chip is accessed at addresses
0x20000000-0x200fffff. Notice that addresses in the chip data sheet
are addresses of 16-bit words, not bytes, so in order to set the
address 0x5555 on chip's A14-A0 pins one has to access the address
0x2000aaaa and respectively 0x20005554 for 0x2aaa.

The external flash ROM is also used to store player's settings.

RAM

The internal PNX0101 64 kBytes of SRAM is located at 0x400000. It is also
visible at the address 0, so exception vectors can be stored there.
There is also most probably 1 MB of RAM at 0x24000000. The original firmware uses lower 512 kB of it.
It is possible to write a value to the upper half and read it back, but I am not yet
sure if those halves are not the same memory mapped twice.
There is no more RAM in the following area. The USB chip is located at 0x24100000 and accessing the
address 0x24200000 causes the player to freeze (perhaps simply causes an exception).

Speed

I have successfully decoded a piece of music in Ogg Vorbis format using the original firmware running in my emulator.
This proves that it is possible to decode Ogg Vorbis files without using the EPIC DSP core.

When I run this loop from the external RAM it executed about 260 000 times per second. When I run it from the internal
RAM it executed about 1 600 000 times per second. It does not seem much to me, I suppose there is a way
to increase the CPU frequency. After the original firmware opens a file and before it starts to play it performs some
accesses to the unknown parts of the hardware. Switching to a higher CPU frequency may be among them.

The above experiment also suggests that when a code is run from the external RAM it is not cached. Finding a way
to turn on caching in the external RAM may be difficult, since the original firmware does not run any code from that memory
and therefore does not need fast execution from there. On the other hand, even the original firmware executes some speed critical parts of the Ogg Vorbis decoder from the internal RAM.

General Purpose Input/Output

The PNX0101 seems to have about 8 general purpose input/output
ports. The exact number of ports, the number of bits in each port and
connections between them and the chip pins are not known. Some of
bits may be used for internal purposes only and therefore their purpose
may be not so general. Each port registers are located in the range
0x80003000 + n * 0x40 to 0x8000303f + n * 0x40, where n is the number
of the port (from 0 to 7).

In the following description base will be 0x80003000 + n *
0x40. Reading from base returns the port state. Writing a value to
base + 0x14 sets to 1 those port bits, whose corresponding bits in the
value are 1, leaving other unchanged. Similarly, writing a value to
base + 0x18 sets to 0 those port bits, whose corresponding bits in the
value are 1. Registers base + 0x24 and base + 0x28 probably set ports
directions. Writing a value to base + 0x24 sets to be outputs those bits
whose corresponding bits in the value are 1 and writing to base +
0x28 sets those bits to be inputs.

Interrupts

IRQ controller registers are located at 0x80300000. They are accessed in an interesting way.
To read a register the original firmware reads the register twice and checks if two readings gave
the same result. If not it repeats the operation. When writing, the firmware checks if two
consecutive readings give the same result and additionaly if the result satisfies some condition.
The condition depends on a register.

There are 28 sources of interrupts numbered from 1 to 28. The original firmware uses only few
of them. When an interrupt occurs bits 3-31 of 0x80300100
contain the number of the interrupt. Each interrupt has a controlling register at 0x80300400 + n * 4.

Interrupt number 5 is a timer interrupt. Interrupt number 28 comes from the audio output when more audio
data is needed.

Timers

There is some kind of timer at 0x80020000. The register at 0x80020000 stores its period.
Frequency of timer is probably 3 MHz / period.

There is also a watchdog. It can be disabled by writing 0 to 0x80002804. Servicing a watchdog
is probably a following sequence of operations: write 0 to 0x80002804, write 0 to 0x80002808,
write 1 to 0x80002804.

A/D Converter

The A/D converter described here is used to get state of the keys and
to measure battery voltage. It is not known if this is also the audio
A/D converter.

The least significant 10 bits of the register at 0x80002400 contain
the state of most of the buttons:

The register at 0x80002408 contains the state of the PLAY button. If its
10 least significant bits are less than or equal 0x64, then the button
is pressed.

There also seem to be one more ADC channel which value is available at the address 0x80002410.
It is not known what is connected to it.

When the original firmware wants to read a value, it writes 0xa to 0x80002420,
waits until bit 4 at the address 0x82002420 becomes 1 and reads the value from one of the registers
described in previous paragraphs.

LCD Screen

The LCD screen is similar to TL032S?, but not identical. The commands
sent by the firmware to the LCD screen make sense for this type of
screen, however before writing to the LCD, the firmware waits until
two least significant bits of the status are 1. In TL032S? those bits
are always 0.

Display status can be read from the register at 0x80104008, data are
written to 0x80104030 and commands are written to 0x80104020.

PNX0101 has an integrated I2C? interface. I have not analysed it in detail yet.
Its registers are located at 0x80020800. 0x80020800 is data register. 0x80020804
is some kind of status register.

There is also another I2C? (or similar) interface implemented using two GPIO ports.
It is used to control an RTC chip. The RTC chip is probably PCF8563.

Power Management

Two GPIO ports has been identified responsible for power management. Writing 0 to bit 0 of port 2
switches the power off. Setting bit 16 of port 1 to 1 switches off the LCD screen.

When the power is switched off without writing 1 to bit 16 of port 1 the LCD seems to be switched off
not smoothly. It displays some noises for a moment. The same effect can be observed when the battery is removed
when the player is on.

FM Tuner

The FM tuner is most probably TEA5767HN?. It is connected to the integrated I2C? interface.

USB interface

Iriver iFP-790 uses ISP1582 USB peripheral controller. Unlike other players to which Rockbox is being ported,
this chip does not implement the protocol layer of USB communication. It has to be
done in firmware.